Legal
Privacy Policy
Last updated: 17 July 2026
This policy explains how the 144th Glasgow (1st Baillieston) Scout Group collects, uses, stores, and protects personal information about our members, parents, volunteers, and anyone who contacts us.
1. Who we are
The 144th Glasgow (1st Baillieston) Scout Group is the data controller for the personal data described in this policy. We are a Scottish registered charity (SC032585) and operate as a volunteer-led youth organisation within The Scout Association.
We are committed to processing personal data fairly and lawfully in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Data Controller contact
144th Glasgow (1st Baillieston) Scout Group
Scottish Charity No: SC032585
Data protection email: data-protection@144glasgowscouts.org (or info@144glasgowscouts.org if you are unsure where to send something)
2. What personal data we collect and why
We only collect data that is necessary for the purpose it is being collected for. Below we explain each type of data we collect, why we collect it, and our legal basis for doing so under UK GDPR.
Contact enquiries
Collected via our Contact Us form
Data collected
Name, email address, subject, message
Purpose
Responding to your query
Legal basis
Legitimate interests — we have a legitimate interest in responding to people who contact us
Joining enquiries
Collected via our Join Us form
Data collected
Parent/carer name, child's name, child's date of birth, section of interest, postcode, optional message
Purpose
Responding to your enquiry and directing you to the Online Scout Manager waiting-list process. The OSM waiting list is the authoritative joining record.
Legal basis
Legitimate interests — necessary to process your joining enquiry
Adult volunteer expressions of interest
Collected via our adult volunteer enquiry form
Data collected
Name, email address, phone number (optional), availability, skills and interests, optional message
Purpose
Starting the adult recruitment process and following up with potential volunteers before formal application, onboarding, and PVG steps
Legal basis
Legitimate interests — necessary to process your expression of interest and manage volunteer recruitment
Adult volunteer applications and onboarding
Collected via our Adult Volunteer Application form and admin onboarding tool
Data collected
Full name, date of birth, gender (optional), home address, email, phone number, emergency contact details, previous Scout experience, first aid qualifications, role/section preferences, skills, occupation, admin notes, onboarding checklist status, and optional uploaded PVG/supporting documents
Purpose
Assessing adult volunteer applications, managing onboarding, processing PVG and safeguarding checks, and setting up OSM, Scouts digital tools, email, Drive, and relevant communications access
Legal basis
Legitimate interests in managing volunteer recruitment and group administration; legal obligation and safeguarding duties where PVG and safer recruitment checks are required
Leaders area sign-in
When leaders sign in via Online Scout Manager OAuth
Data collected
OSM user ID and first name (retrieved from Online Scout Manager)
Purpose
Verifying your status as an active leader and providing access to the leaders area
Legal basis
Legitimate interests — necessary to secure leader-only tools and resources
Accident and incident reports
Recorded via our Accident Report form (leaders area)
Data collected
Names and ages of individuals involved, description of injury or incident, treatment given, names of witnesses, circumstances
Purpose
Recording and investigating incidents as required by The Scout Association's safety policies and health and safety legislation
Legal basis
Legal obligation / legitimate interests — required for health and safety compliance and insurance purposes
Photos and media
Used on official group channels, including the website and official social media
Data collected
Photos and videos from Scout activities, and media consent status held in Online Scout Manager
Purpose
Sharing group news and celebrating activities through official group channels, where consent permits
Legal basis
Consent / legitimate interests, depending on the context and the consent recorded in OSM
Informal WhatsApp communication
Used for informal parent, leader, and Explorer communication
Data collected
Your WhatsApp account details, messages you choose to send, and email address if you request an invite link
Purpose
Informal reminders, routine logistics, parent community, Explorer age-appropriate messages, and short-term coordination
Legal basis
Legitimate interests — helping current members and families stay informed. Formal records and sensitive matters should use official group email, OSM, or restricted group systems.
Website analytics
Collected only if you accept analytics cookies
Data collected
Aggregate page views, referrers, device/browser information, approximate location, and basic performance data (Google Analytics 4)
Purpose
Understanding which pages are useful, how popular the website is, and whether pages are working well
Legal basis
Consent — analytics only runs if you accept it via the cookie banner, and you can withdraw at any time via "Cookie settings" in the footer. We do not use analytics for advertising or profiling.
Security and anti-abuse data
Collected automatically during form submissions and sign-in requests
Data collected
IP addresses
Purpose
Preventing automated abuse and spam, rate-limiting requests, investigating security incidents
Legal basis
Legitimate interests — we have an interest in protecting our services from abuse
3. Who we share your data with
We do not sell personal data. We only share data with trusted third parties where it is necessary to deliver our services or where we are legally required to do so. All third-party processors are required to handle data securely and in accordance with UK GDPR.
Online Scout Manager (Compass Digital Ltd)
Our primary member management system. OSM holds the authoritative record of membership, section, and contact details. We cross-reference your email address against OSM when we need to confirm you are a current member family — for example, when you request a WhatsApp invite link. OSM has its own privacy policy at onlinescoutmanager.co.uk.
Google (Firebase and Google Workspace)
We use Google Firebase for our website's database, authentication, file storage, and cloud functions. We use Google Workspace for group email and document storage (including accident reports stored in a private Google Drive) — transactional emails such as form confirmations are sent through our own Google Workspace account. If you accept analytics cookies, we also use Google Analytics 4 to collect aggregate usage statistics. Google's privacy policy is at policies.google.com.
Cloudflare
We use Cloudflare Turnstile to protect our forms from automated spam and abuse. Cloudflare may process your IP address and device information as part of this service. No advertising cookies are placed. Cloudflare's privacy policy is at cloudflare.com.
We use WhatsApp for informal member, parent, Explorer, and leader communication. WhatsApp is not our official record-keeping system and should not be used for sensitive personal data. Formal matters are handled through official group email, OSM, or restricted group systems.
Facebook and official social media
We may publish activity photos and group updates on official group channels where consent permits. The website may reuse or sync photos from our official Facebook page. If someone appears in the background of a large group photo and wants it removed, contact us and we will remove it as soon as an available adult can do so.
The Scout Association
As a member group, we share anonymised data with The Scout Association for their annual national census. This includes aggregate figures on age, gender, section, and badge achievements. This data cannot be used to identify individuals.
HMRC
If you have signed a Gift Aid declaration, your name, address, and relevant donation details are shared with HMRC as required by law for Gift Aid reclaim purposes. This creates a permanent record that we are legally required to retain.
4. International data transfers
Some of our third-party processors may transfer and process personal data outside the United Kingdom, including in the United States.
Where this occurs, we ensure that appropriate safeguards are in place. Google LLC participates in the EU–US Data Privacy Framework and provides Standard Contractual Clauses approved under UK GDPR to cover international transfers. Cloudflare operates under similar adequacy arrangements.
If you have questions about international transfers, please contact us.
6. How long we keep your data
We retain personal data only for as long as necessary. The table below summarises our retention periods.
| Data type | Retention period | Notes |
|---|---|---|
| Contact / enquiry / volunteer forms | 90 days, unless converted into an active matter | Generic contact is treated like emailing the group. Adult expressions of interest are handled as recruitment records once they move into that process. |
| Adult expressions of interest | Until converted into an onboarding record, then handled under the onboarding retention rule | If they do not proceed, the expression record is deleted as part of normal recruitment cleanup. |
| Rejected adult applications | 30 days after the application is marked rejected | The onboarding tool reminds admins to delete the full candidate record and any uploaded documents. |
| Successful application and onboarding records | 30 days after onboarding is marked complete on this website | The authoritative ongoing records are then held in Scouts digital tools, OSM, PVG/official systems, and group systems as appropriate. |
| PVG identity documents | During onboarding and up to 30 days after completion or rejection | Documents are accessible only to authorised onboarding admins and are deleted with the candidate record. |
| Leader session data | Up to 1 hour | Session expires automatically |
| Accident and incident reports | 7 years | In line with Scout Association guidance and standard limitation periods |
| WhatsApp chats | Not routinely retained by the group | Chats are informal and may be subject to users' own settings. If a leader needs to preserve a message, they should save it into the appropriate restricted group record. |
| IP addresses (security logs) | 2–90 days | Automatically deleted |
| Gift Aid declarations | Permanent | Required by HMRC |
7. Your rights under UK GDPR
Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data. These rights are not absolute and may be subject to exemptions in some circumstances.
Right to be informed
You have the right to know how and why your data is processed. This privacy policy fulfils that obligation.
Right of access (Subject Access Request)
You have the right to request a copy of the personal data we hold about you. We will respond within one month.
Right to rectification
You have the right to ask us to correct inaccurate or incomplete personal data we hold about you.
Right to erasure ("right to be forgotten")
In certain circumstances, you have the right to ask us to delete your personal data. This right does not apply where we are required by law to retain records (e.g., accident reports, Gift Aid).
Right to restriction of processing
You have the right to ask us to pause processing of your data in certain circumstances, for example while a dispute about accuracy is being resolved.
Right to data portability
Where processing is based on your consent or a contract, and is carried out by automated means, you have the right to receive your data in a structured, commonly used format.
Right to object
You have the right to object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds.
Rights related to automated decision-making
We do not make any automated decisions about individuals based on personal data. This right is therefore not currently applicable.
To exercise any of these rights
Email us at data-protection@144glasgowscouts.org with the subject line "Data Protection Request". You can also use info@144glasgowscouts.org as a fallback. We will acknowledge your request within 5 working days and respond in full within one month.
8. How to contact us
For any questions about this privacy policy, to exercise your data rights, or to raise a concern about how we handle personal data, please contact us:
144th Glasgow (1st Baillieston) Scout Group
Email: data-protection@144glasgowscouts.org (subject: "Data Protection")
Fallback: info@144glasgowscouts.org
Registered charity: SC032585 (Scotland)
9. Making a complaint
We take data protection seriously. You have the right to complain to us directly about how we have handled your personal data, and we encourage you to contact us first so we can try to put things right.
To make a data protection complaint, email data-protection@144glasgowscouts.org with the subject line "Data Protection Complaint" (or use info@144glasgowscouts.org). We will acknowledge your complaint within 30 days of receiving it, look into it properly — including taking any appropriate steps to resolve the issue — and let you know the outcome without undue delay.
If you are not satisfied with our response, you also have the right to lodge a complaint with the UK's data protection supervisory authority at any time:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113
Live chat available on the ICO website
10. Changes to this policy
We may update this privacy policy from time to time as our services change or as required by law. We will update the "Last updated" date at the top of this page when we do so.
This policy was last reviewed and updated on 17 July 2026.